DSPT for Care Homes: Evidence Requirements Explained
As a care home registered manager, the DSPT is one of several annual compliance obligations competing for your time alongside CQC inspections, staffing, safeguarding, and day-to-day operations. This guide cuts through the generic advice and focuses specifically on what care homes — residential and nursing — need to submit.
Care homes fall under Category 3 in the DSPT, which has a pre-determined set of mandatory evidence items across the 10 National Data Guardian standards — 45 in NHS England's version 8 (2025/26) and version 9 (2026-27) workbooks, and NHS England states that "the number of mandatory questions are determined by your organisation type", so work from the list your own toolkit shows you. You don't need an independent audit (that's Categories 1 and 2 only), but your evidence needs to be current, specific, and actually uploaded to the portal by the 30 June deadline.
Care home-specific challenges
Care homes face DSPT challenges that pharmacies and GP practices don't:
- High staff turnover. A care home with 30 staff may see 10+ starters and leavers per year. Every one of those changes means training records to track and system access to manage.
- Mixed IT literacy. Staff range from nurses comfortable with clinical systems to care assistants who primarily use paper. Getting everyone through online data security training requires coordination.
- Agency and bank staff. Temporary staff need data security training too. Getting certificates from agencies — or requiring completion of your own training — adds administrative overhead.
- Multiple access points. Medication administration records (MAR charts), care plans, resident information, NHSmail — several systems hold personal data, often accessed by different staff groups.
- No dedicated IT. Most care homes under 60 beds don't have an IT department. The registered manager or a deputy handles everything, often with an external IT support company.
Evidence requirements by standard
Here's what Category 3 care homes typically need for each of the 10 NDG standards. This reflects DSPT version 9 (2026-27) requirements — always verify against the official portal.
Standard 1: Personal confidential data
What they're asking: Is resident data handled, stored and transmitted securely, and only shared for lawful and appropriate purposes? (Who can access what is Standard 4.)
Evidence you need:
- An information asset register and record of processing activities (item 1.1.2): the systems and records holding resident data (care planning software, NHSmail, paper records), what they hold and who you share it with
- Data protection and cyber security policies customised to your care home, not a generic template, and updated at least every three years (item 1.3.1)
- The named person or people with overall responsibility for data security and protection, usually the registered manager (item 1.1.5)
Care home tip: List paper records too: care plans, MAR charts and handover sheets kept in the building all belong in the register. NHS England's tooltip for 1.1.2 says "The register should have been reviewed and approved by the management team at least once in the last twelve months."
Standard 2: Staff responsibilities
What they're asking: Do staff understand their data security responsibilities?
Evidence you need:
- An induction process that covers data security and protection, and cyber security, with completion records (item 2.1.1)
- Employment contracts and volunteer agreements with a data security clause (item 2.2.1). NHS England's tooltip says clauses "should reference data security (confidentiality, integrity and availability)" and warns that "Many contracts commonly focus on just confidentiality."
Care home tip: Add a data security section to your induction checklist and have each new starter sign it. Digital Care Hub publishes an example staff contract clause, linked from the 2.2.1 tooltip. An annual policy sign-off at a team meeting is good practice too: record the date, attendees and what was covered.
Standard 3: Training
What they're asking: Have at least 95% of staff, directors, trustees and volunteers completed data security training in the last twelve months (item 3.2.1)?
Evidence you need:
- Training completion records for every member of staff
- Certificates or completion confirmations with dates
- Coverage of temporary/agency staff
Care home tip: This is the evidence item that catches most care homes out. Start sending training in January — not April. The free NHS e-Learning for Healthcare module generates certificates automatically. For staff who struggle with online learning, you can use a supervised group session with the training material on a projector — record attendance and individual acknowledgements.
Agency staff count towards the 95%: NHS England's e-learning FAQ says item 3.2.1 covers "95% of all staff including new starters, locums, temporary, students and staff contracted to work in the organisation". For agency staff, either:
- Ask agencies for data security training certificates for each worker they send, or
- Include agency workers in your own training sessions.
Asking agency workers to acknowledge your data security policy on their first shift is good practice on top of training, not instead of it.
For what the training record itself needs to show, and what the training needs analysis should cover, see our DSPT staff training requirements guide.
Standard 4: Managing data access
What they're asking: Is access properly controlled and reviewed?
Evidence you need:
- Access control register (who has access to what, and what level)
- Documented joiner/leaver process
- Evidence of regular access reviews (if your care plans are on a digital system, a screenshot of its user management screen showing roles and access levels works well)
- A list of your IT system administrators, each with a signed agreement holding them to higher standards (item 4.3.1, mandatory for Category 3 since version 8)
Care home tip: Create a simple spreadsheet listing every staff member, the systems they access, their role/access level, and the date access was last reviewed. When someone leaves, update the spreadsheet and remove their access the same day. Screenshot the system's user management screen showing the account has been disabled — that's your evidence.
Standard 5: Process reviews
What they're asking: Have you reviewed the process behind any data or cyber security breach or near miss in the last year? Item 5.1.1, mandatory for Category 3 and 4, asks: "If your organisation has had a data or a cyber security breach or near miss in the last year, has the organisation reviewed the process that may have allowed the breach to occur?" If there were none, NHS England's tooltip says to tick and write "Not applicable".
Evidence you need:
- A short record of each post-incident review: what happened, which process allowed it, and what you changed
- If there were no breaches or near misses, a note saying so ("Not applicable" in the toolkit)
- Optional: an annual review of your data processes. The tooltip says "It is good practice to review processes annually even if a breach or near miss has not taken place."
Policy review dates belong to Standard 1 (item 1.3.1; item 1.3.2 covers checking compliance with your policies), not Standard 5.
Care home tip: Add a "last reviewed" date and "next review" date to every policy document. Review all data-related policies together annually — data security, acceptable use, retention, breach notification. One annual review session covering all policies is more realistic than reviewing each one individually.
Standard 6: Responding to incidents
What they're asking: Can you detect and respond to data security incidents?
Evidence you need:
- Incident reporting procedure
- Evidence that staff know how to report incidents
- Incident log (even if no incidents have occurred — the log proves the process exists)
Care home tip: Your incident procedure should cover: what counts as a data incident (lost phone, misdirected email, suspected breach), who to report it to (registered manager), and what happens next (assessment, ICO notification if required). If you've had zero incidents, that's fine — the empty log with the procedure attached shows you have a working system.
Standard 7: Continuity planning
What they're asking: What happens if your systems fail?
Evidence you need:
- Business continuity plan covering IT failure, cyber attack, and data loss
- Evidence that the plan is regularly reviewed and tested (item 7.1.2), including a test in the last twelve months: item 7.2.1 asks how you test it and what the outcome was, and NHS England's tooltip says "This should be in the last twelve months."
Care home tip: Your BCP for a care home should answer these questions:
- If the care planning system goes down, where are the paper backup MAR charts?
- If NHSmail is unavailable, how do you communicate with GPs and hospitals?
- If you suffer a ransomware attack, who do you call? (Your IT provider, and Action Fraud on 0300 123 2040)
- Where are your offline backups of critical resident information?
A 2-3 page document covering these scenarios is sufficient. You don't need a 50-page disaster recovery plan.
Standard 8: Unsupported systems
What they're asking: Are all your devices running supported software?
Evidence you need:
- IT asset register (hardware and software inventory with OS versions)
- Confirmation that no unsupported operating systems are in use, or a risk document for any you keep (item 8.2.1)
Care home tip: The "digital asset register" (item 7.1.1, which the toolkit numbers under Standard 7) has been mandatory for Category 3 since version 8. List every computer, tablet, and phone used by staff, the operating system version, and the key software installed. If your IT provider manages your devices, ask them for this list — most can generate it from their remote management tools.
Check for old Windows 7 or Windows 8 machines that may still be in offices or nurse stations. These are unsupported: replace them, or record why you are keeping them, the risks and what you are doing to reduce them. Item 8.1.4 asks whether your systems are "still supported by the manufacturer or the risks are understood and managed", and item 8.2.1 asks for that risk document.
Standard 9: IT protection
What they're asking: Are technical security controls in place?
Evidence you need:
- Encryption on laptops, tablets and removable devices holding resident data (item 9.5.2)
- Confirmation that router and other network-device passwords have been changed from the originals (item 9.1.1)
- Firewall configuration confirmation (item 9.6.1, not mandatory)
The toolkit numbers two related controls under other standards, but the same IT letter can cover them: patching (Standard 8, item 8.3.5) and anti-malware/antivirus (Standard 6, item 6.2.1).
Care home tip: If you have a managed IT provider, ask them for a single assurance letter covering all of these. Most providers can issue a standard statement confirming: firewalls are configured, patches are applied automatically, devices have encryption enabled (BitLocker for Windows, FileVault for Mac), and antivirus is installed and updated.
Standard 10: Accountable suppliers
What they're asking: Do your suppliers meet data security standards?
Evidence you need:
- Supplier assurance statements from IT providers and software vendors
- Data processing agreements (DPAs) with suppliers handling resident data
Care home tip: Your key suppliers are likely: your care planning software provider, your managed IT company, and your NHSmail/clinical system connections. Email each one asking for: (a) their DSPT completion status or equivalent assurance, and (b) a copy of your data processing agreement. Keep these on file — you'll need them every year.
Timeline for care homes
| When | What to do | Time needed |
|---|---|---|
| January | Send staff training, start tracking completions | 1-2 hours |
| February | Audit evidence — what you have vs what you need | 2-3 hours |
| March | Update policies, create asset register | 3-4 hours |
| April | Document access controls, request supplier statements | 2-3 hours |
| May | Chase training completions, upload evidence | 3-4 hours |
| June | Final review and submit | 1-2 hours |
Total: approximately 12-18 hours over 6 months — about 30-45 minutes per week.
Next steps
-
Use our evidence checklist generator to get a complete Category 3 checklist
-
Check the deadline calculator to see how much time you have
-
Draft the Standard 7 plan with our DSPT business continuity guide
-
Read the complete DSPT guide for a broader overview of the current requirements
-
Dive deeper into the evidence requirements by category for the assertion-by-assertion breakdown
-
See what changed in version 8 — including the digital asset register and the administrator agreement — in our DSPT v8 changes explained guide
-
If you also run a domiciliary care branch, the DSPT for domiciliary care guide covers the device and data-in-transit items that a residential setting doesn't have to answer
This guide reflects DSPT version 9 (2026-27), the current toolkit, for Category 3 organisations. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.